CVE-2026-111450

Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request...

Exploit for CVE-2026-29519

CVE-2026-29519-Lucee-Reflected-XSS Proof of Concept for Reflec...